small fixes

detections/cloud/azure_ad_global_administrator_role_assigned.yml

@@ -5,9 +5,9 @@ date: '2022-08-17'
 author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: The following analytic identifies when an Administrator assign Global Administrator role to a user. 
-  Global Admin role is the most powerfull administrator role in Azure AD. It is (almost) equivalent to the local system rigths in traditional Windows environment. 
-  Attackers may use this technique to create Persistence in the Azure AD environment. Adding Global Administrator role is not the best security practice as well as not a common practice.
+description: The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. 
+  The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment.
+  Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
 search: '`azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global Administrator\"" 
   | rename body.properties.* as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName 
@@ -17,9 +17,12 @@ search: '`azuread` "body.operationName"="Add member to role"  "body.properties.t
   | `azure_ad_global_administrator_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. 
   Specifically, this analytic leverages the AuditLogs log category.
-known_false_positives: Administrator may legitimately assign Global Admin to a user. Filter as needed.
+known_false_positives: Although rare, Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
 references:
-- https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns
+- https://o365blog.com/post/admin/
+- https://adsecurity.org/?p=4277
+- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
+- https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning
 - https://attack.mitre.org/techniques/T1098/003/
 tags:
   analytic_story:

detections/cloud/azure_ad_service_principal_created.yml

@@ -5,11 +5,10 @@ date: '2022-08-17'
 author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: The following analytic identifies when a Service Principal is created.
-  An Azure service principal is an identity designed for use with apps, services, and automated tools to access resources. 
-  This access is restricted by the roles assigned to the service principal, giving you control over which resources can be accessed and at which level.
-  It's advised to employ service principals with automated tools rather than letting them log in using user identities for security concerns.
-  Attackers can use this method to create Persistence in the Azure AD environment and login whenever they want.
+description: The following analytic identifies the creation of a Service Principal in an Azure AD environment.
+  An Azure Service Principal is an identity designed for use with apps, services, and automated tools to access resources. 
+  This access is restricted by the roles assigned to the Service Principal, giving users control over which resources can be accessed and at which level.
+  Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence in the Azure AD environment.
 search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=*   
   | rename body.properties.* as * 
   | rename targetResources{}.displayName as displayName 
@@ -23,6 +22,7 @@ known_false_positives: Administrator may legitimately create Service Principal.
 references:
 - https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
 - https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-8.2.0
+- https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns
 - https://attack.mitre.org/techniques/T1136/003/
 tags:
   analytic_story:

detections/cloud/azure_ad_service_principal_new_client_credentials.yml

@@ -41,7 +41,7 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   - Installation
-  message: UPDATE message
+  message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$ 
   mitre_attack_id:
   - T1098
   - T1098.001